Coverage Report

Created: 2026-09-06 07:25

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/suricata8/src/detect-engine-helper.c
Line
Count
Source
1
/* Copyright (C) 2023 Open Information Security Foundation
2
 *
3
 * You can copy, redistribute or modify this Program under the terms of
4
 * the GNU General Public License version 2 as published by the Free
5
 * Software Foundation.
6
 *
7
 * This program is distributed in the hope that it will be useful,
8
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
10
 * GNU General Public License for more details.
11
 *
12
 * You should have received a copy of the GNU General Public License
13
 * version 2 along with this program; if not, write to the Free Software
14
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
 * 02110-1301, USA.
16
 */
17
18
/**
19
 * \file
20
 *
21
 * \author Philippe Antoine <p.antoine@catenacyber.fr>
22
 *
23
 */
24
25
#include "suricata-common.h"
26
#include "detect-engine.h"
27
#include "detect-engine-helper.h"
28
#include "detect-engine-mpm.h"
29
#include "detect-engine-prefilter.h"
30
#include "detect-parse.h"
31
#include "detect-engine-content-inspection.h"
32
#include "rust.h"
33
34
int SCDetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t direction)
35
1.52k
{
36
1.52k
    if (direction & STREAM_TOSERVER) {
37
1.32k
        DetectAppLayerInspectEngineRegister(
38
1.32k
                name, alproto, SIG_FLAG_TOSERVER, 0, DetectEngineInspectGenericList, NULL);
39
1.32k
    }
40
1.52k
    if (direction & STREAM_TOCLIENT) {
41
1.28k
        DetectAppLayerInspectEngineRegister(
42
1.28k
                name, alproto, SIG_FLAG_TOCLIENT, 0, DetectEngineInspectGenericList, NULL);
43
1.28k
    }
44
1.52k
    return DetectBufferTypeRegister(name);
45
1.52k
}
46
47
int SCDetectHelperBufferProgressRegister(
48
        const char *name, AppProto alproto, uint8_t direction, int progress)
49
78
{
50
78
    if (direction & STREAM_TOSERVER) {
51
78
        DetectAppLayerInspectEngineRegister(
52
78
                name, alproto, SIG_FLAG_TOSERVER, progress, DetectEngineInspectGenericList, NULL);
53
78
    }
54
78
    if (direction & STREAM_TOCLIENT) {
55
78
        DetectAppLayerInspectEngineRegister(
56
78
                name, alproto, SIG_FLAG_TOCLIENT, progress, DetectEngineInspectGenericList, NULL);
57
78
    }
58
78
    return DetectBufferTypeRegister(name);
59
78
}
60
61
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
62
        uint8_t direction, InspectionSingleBufferGetDataPtr GetData)
63
1.16k
{
64
1.16k
    if (direction & STREAM_TOSERVER) {
65
1.01k
        DetectAppLayerInspectEngineRegisterSingle(
66
1.01k
                name, alproto, SIG_FLAG_TOSERVER, 0, DetectEngineInspectBufferSingle, GetData);
67
1.01k
        DetectAppLayerMpmRegisterSingle(
68
1.01k
                name, SIG_FLAG_TOSERVER, 2, PrefilterSingleMpmRegister, GetData, alproto, 0);
69
1.01k
    }
70
1.16k
    if (direction & STREAM_TOCLIENT) {
71
778
        DetectAppLayerInspectEngineRegisterSingle(
72
778
                name, alproto, SIG_FLAG_TOCLIENT, 0, DetectEngineInspectBufferSingle, GetData);
73
778
        DetectAppLayerMpmRegisterSingle(
74
778
                name, SIG_FLAG_TOCLIENT, 2, PrefilterSingleMpmRegister, GetData, alproto, 0);
75
778
    }
76
1.16k
    DetectBufferTypeSetDescriptionByName(name, desc);
77
1.16k
    return DetectBufferTypeGetByName(name);
78
1.16k
}
79
80
int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
81
        uint8_t direction, InspectionSingleBufferGetDataPtr GetData, int progress)
82
468
{
83
468
    if (direction & STREAM_TOSERVER) {
84
468
        DetectAppLayerInspectEngineRegisterSingle(name, alproto, SIG_FLAG_TOSERVER, progress,
85
468
                DetectEngineInspectBufferSingle, GetData);
86
468
        DetectAppLayerMpmRegisterSingle(
87
468
                name, SIG_FLAG_TOSERVER, 2, PrefilterSingleMpmRegister, GetData, alproto, progress);
88
468
    }
89
468
    if (direction & STREAM_TOCLIENT) {
90
117
        DetectAppLayerInspectEngineRegisterSingle(name, alproto, SIG_FLAG_TOCLIENT, progress,
91
117
                DetectEngineInspectBufferSingle, GetData);
92
117
        DetectAppLayerMpmRegisterSingle(
93
117
                name, SIG_FLAG_TOCLIENT, 2, PrefilterSingleMpmRegister, GetData, alproto, progress);
94
117
    }
95
468
    DetectBufferTypeSetDescriptionByName(name, desc);
96
468
    return DetectBufferTypeGetByName(name);
97
468
}
98
99
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
100
        AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
101
1.01k
{
102
1.01k
    if (direction & STREAM_TOSERVER) {
103
897
        DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2);
104
897
    }
105
1.01k
    if (direction & STREAM_TOCLIENT) {
106
741
        DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOCLIENT, progress, GetData, 2);
107
741
    }
108
1.01k
    DetectBufferTypeSupportsMultiInstance(name);
109
1.01k
    DetectBufferTypeSetDescriptionByName(name, desc);
110
1.01k
    return DetectBufferTypeGetByName(name);
111
1.01k
}
112
113
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
114
        uint8_t direction, InspectionMultiBufferGetDataPtr GetData)
115
819
{
116
819
    return SCDetectHelperMultiBufferProgressMpmRegister(name, desc, alproto, direction, GetData, 0);
117
819
}
118
119
int SCDetectHelperNewKeywordId(void)
120
12.7k
{
121
12.7k
    if (DETECT_TBLSIZE_IDX >= DETECT_TBLSIZE) {
122
0
        void *tmp = SCRealloc(
123
0
                sigmatch_table, (DETECT_TBLSIZE + DETECT_TBLSIZE_STEP) * sizeof(SigTableElmt));
124
0
        if (unlikely(tmp == NULL)) {
125
0
            return -1;
126
0
        }
127
0
        sigmatch_table = tmp;
128
0
        memset(&sigmatch_table[DETECT_TBLSIZE], 0, DETECT_TBLSIZE_STEP * sizeof(SigTableElmt));
129
0
        DETECT_TBLSIZE += DETECT_TBLSIZE_STEP;
130
0
    }
131
132
12.7k
    DETECT_TBLSIZE_IDX++;
133
12.7k
    return DETECT_TBLSIZE_IDX - 1;
134
12.7k
}
135
136
uint16_t SCDetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw)
137
10.4k
{
138
10.4k
    int keyword_id = SCDetectHelperNewKeywordId();
139
10.4k
    if (keyword_id < 0) {
140
0
        return -1;
141
0
    }
142
143
10.4k
    sigmatch_table[keyword_id].name = kw->name;
144
10.4k
    sigmatch_table[keyword_id].desc = kw->desc;
145
10.4k
    sigmatch_table[keyword_id].url = kw->url;
146
10.4k
    sigmatch_table[keyword_id].flags = kw->flags;
147
10.4k
    sigmatch_table[keyword_id].AppLayerTxMatch =
148
10.4k
            (int (*)(DetectEngineThreadCtx * det_ctx, Flow * f, uint8_t flags, void *alstate,
149
10.4k
                    void *txv, const Signature *s, const SigMatchCtx *ctx)) kw->AppLayerTxMatch;
150
10.4k
    sigmatch_table[keyword_id].Setup =
151
10.4k
            (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
152
10.4k
    sigmatch_table[keyword_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
153
154
10.4k
    return (uint16_t)keyword_id;
155
10.4k
}
156
157
void SCDetectHelperKeywordAliasRegister(uint16_t kwid, const char *alias)
158
639
{
159
639
    sigmatch_table[kwid].alias = alias;
160
639
}
161
162
int SCDetectHelperTransformRegister(const SCTransformTableElmt *kw)
163
1.38k
{
164
1.38k
    int transform_id = SCDetectHelperNewKeywordId();
165
1.38k
    if (transform_id < 0) {
166
0
        return -1;
167
0
    }
168
169
1.38k
    sigmatch_table[transform_id].name = kw->name;
170
1.38k
    sigmatch_table[transform_id].desc = kw->desc;
171
1.38k
    sigmatch_table[transform_id].url = kw->url;
172
1.38k
    sigmatch_table[transform_id].flags = kw->flags;
173
1.38k
    sigmatch_table[transform_id].Transform =
174
1.38k
            (void (*)(DetectEngineThreadCtx * det_ctx, InspectionBuffer * buffer, void *options))
175
1.38k
                    kw->Transform;
176
1.38k
    sigmatch_table[transform_id].TransformValidate = (bool (*)(
177
1.38k
            const uint8_t *content, uint16_t content_len, void *context))kw->TransformValidate;
178
1.38k
    sigmatch_table[transform_id].Setup =
179
1.38k
            (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup;
180
1.38k
    sigmatch_table[transform_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free;
181
1.38k
    sigmatch_table[transform_id].TransformId =
182
1.38k
            (void (*)(const uint8_t **id_data, uint32_t *length, void *context))kw->TransformId;
183
184
1.38k
    return transform_id;
185
1.38k
}